CVE-2015-9171

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05

Description A buffer over-read issue occurs when the OEMCrypto Dash InstallEncapKeybox() function is called with the keyBoxLength variable set to a value higher than TZ WV MAX DATA LEN (20k).

Recommendations For Android versions prior to 2018-04-05, as a temporary workaround, consider restricting the use of the OEMCrypto Dash InstallEncapKeybox() function to prevent the buffer over-read issue until a patch is available. Ensure that the keyBoxLength variable is validated to be within the allowed range to prevent exploitation.